Regulation on safeguarding requirements applicable to payment institutions and electronic money institutions

1 of 4 Pursuant to Article 35, paragraph 1, subparagraph 1.1, Article 65 of Law No. 03/L-209 on the Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No. 77/16 August 2010), amended and supplemented by Law No. 05/L -150 (Official Gazette of the Republic of Kosovo/ No. 10/ 03 April 2017) and pursuant to Article 136, Article 11, Article 33, paragraph 3, of Law No. 10/L￾026 on Payment Services (Official Gazette of the Republic of Kosovo,No.10 / 14 May 2026), the Board of the Central Bank of the Republic of Kosovo, at its meeting held on June 29, 2026, approved the following: REGULATION ON SAFEGUARDING REQUIREMENTS APPLICABLE TO PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS Article 1 Purpose and scope

1. The purpose of this Regulation is to set out requirements for the safeguarding of funds by payment institutions and electronic money institutions pursuant to Article 11, Article 33, Article 29 paragraph 3 of the Law No.10/L-026 on Payment Services ("Law on Payment Services ").
2. This Regulation shall apply to payment institutions and electronic money institutions authorized by the Central Bank of Kosovo under the Law on Payment Services. Article 2 Definitions The terms and definitions used in this Regulation shall have the same meaning as in Article 4 of the Law on Payment Services. Article 3 Safeguarding requirements for payment institution
3. Payment institution which provides payment services as referred to in subparagraphs 1.2.1 to 1.2.6 of Article 4 of the Law on Payment Services shall safeguard all funds which have been received from the payment service users or through another payment service provider for the execution of payment transactions, in either of the following alternative ways: 1.1. funds shall not be commingled at any time with the funds of any natural or legal person other than payment service users on whose behalf the funds are held and, where they are still held by the payment institution and not yet delivered to the payee or transferred to another payment service provider by the end of the business day following the day when the funds have been received, they shall be deposited in a separate fiduciary account in a bank licensed

2 of 4 in Republic of Kosovo, CBK or invested in secure, liquid low-risk assets according to Table 1 of Article 83 of the CBK Regulation on Capital Adequacy of Banks, for which the specific risk capital charge is no higher than 1,6 %, but excluding other qualifying items as defined in Article 84 of that Regulation and they shall be insulated in accordance with the Law on Payment Services and any applicable Law in the Republic of Kosovo in the interest of the payment service users against the claims of other creditors of the payment institution, in particular in the event of insolvency; 1.2. funds shall be secured by an insurance policy or some other comparable guarantee from an insurance company or a bank, as specified by an instruction issued by the CBK, which does not belong to the same group as the payment institution itself, for an amount equivalent to that which would have been segregated in the absence of the insurance policy or other comparable guarantee, payable in the event that the payment institution is unable to meet its financial obligations. 2. In implementing the requirement of paragraph 1 of this Article, the payment institution shall approve the internal documents establishing the process of safeguarding funds, accounting and internal control procedures of such funds. These internal documents shall be periodically reviewed at the frequency chosen by the institution. If the institution chooses to apply both methods of safeguarding the funds referred to in paragraph 1 of this Article, the internal documents shall clearly specify which funds and which method will be applied. 3. The terms and conditions of the agreement on the opening of a funds safeguarding account or the agreement on the opening of a securities safeguarding account, including any annexes to those agreements, shall specify that the relevant account is intended exclusively for the safekeeping and handling of payment service users' funds transferred to the institution or of securities acquired in relation to funds received by the institution from payment service users, and that such funds and securities shall remain the property of the payment service users who transferred them and the recovery under the institution’s debts may not be levied on such funds and securities. 4. If the terms and conditions of the agreement on the opening of the funds safeguarding account or the agreement on the opening of the securities safeguarding account, including any annexes to those agreements, do not contain the appropriate provisions on the safeguarding of payment service users' funds, the institution shall obtain a confirmation from the bank or securities depository or enter into a separate agreement containing at least the following information 4.1. the date of issue of the confirmation or of the conclusion of the agreement; 4.2. the name of the institution; 4.3. the number(s) of the account(s) in which the funds or securities of payment service users transferred to the institution are held; 4.4. a confirmation that, from the date specified in the confirmation, the account(s) will be used exclusively for the safeguarding and handling of funds or securities received from payment service users and that the ownership of those funds or securities will remain with the payment service users and cannot be recovered under the institution's liabilities; 4.5. the signature of the authorized employee when the confirmation is issued or the signatures of both parties when a separate agreement is entered into.

3 of 4 5. Provision of paragraphs 3 and 4 of this Article apply mutant mutandis for institution which choose to apply method referred to in subparagraph 1.2 of paragraph 1 of this Article. 6. The internal control procedures shall include at least the reconciliation of funds, comparing the balance of the funds’ protection account at the end of the selected day with the amount of payment service users' funds to be protected. The periodicity of the reconciliation process shall be specified in the internal documentation. The greater the risk of discrepancy between these amounts, the more frequently the reconciliation procedure should be carried out by the institution. The reconciliation of amounts shall be documented. 6.1. if the amount in the funds’ safeguarding account is found to be insufficient in relation to the amount of funds of payment service users to be safeguarded, the institution shall identify the reasons for the shortfall and immediately transfer the missing amount to the funds safeguarding account; 6.2. if the funds in the funds’ safeguarding account are found to be in excess of the funds of payment service users to be safeguarded, the institution shall clarify the reasons for the excess and reduce the excess funds in the funds safeguarding account in accordance with the procedure laid down in its internal documents. 7. Payment service users' funds safeguarded in accordance with this Article shall not be the property of the payment institution and shall not be included in its assets or in liquidation or bankruptcy proceedings, nor shall they be subject to execution or forced collection against the payment institution, nor shall they be used as collateral or any type of security. 7.1. if bankruptcy proceedings are instituted against the payment institution, funds held in separate trust accounts pursuant to this Article and Article 11 of the Law on Payment Services may be used only to meet the payment institution's obligations to payment service users. 8. Where a payment institution is required to safeguard funds under paragraph 1 and a portion of those funds is to be used for future payment transactions and the remainder is to be used for non￾payment services, that portion of the funds to be used for future payment transactions shall also be subject to the requirements of paragraph 1 of this Article. 8.1. where that portion of funds is variable or not known in advance, payment institutions may apply this paragraph on the basis of a representative portion assumed to be used for payment services, provided that such representative portion can be reasonably estimated on the basis of historical data to the satisfaction of the CBK. 9. A payment institution must, one month in advance, give a notice to the CBK of major changes in the safeguarding requirements set by this Article and applicable to the funds received by payment services users. Article 4 Safeguarding requirements for electronic money institutions

1. Electronic money institutions shall safeguard funds that have been received in exchange for electronic money that have been issued, in accordance with Article 11 of the Law on Payment Services and Article 4 of this regulation:

4 of 4 1.1. funds received in the form of payment-by-payment instrument need not be safeguarded until they are credited to the electronic money institution’s payment account or are otherwise made available to the electronic money institution in accordance with the execution time requirements in the Section III of the Law on Payment Services, where applicable; 1.2. in any event, such funds shall be safeguarded by no later than five business days, after the issuance of electronic money. 2. Article 11 of the Law on Payment Services and Article 3 of this regulation shall apply to electronic money institutions for the activities referred to in subparagraph 1.1 of Article 32 of the Law on Payment Services that are not linked to the activity of issuing electronic money. 3. An electronic money institution must, one month in advance, give a notice to the CBK of major changes in the safeguarding requirements set by this Article and applicable to the funds received by electronic money holders for issued electronic money. Article 5 Enforcement, Improvement Measures and Penalties Any violation of the provisions of this Regulation shall be subject to corrective measures and/or administrative penalties as defined within article 67 of the Law No. 03/L-209 on Central Bank of the Republic of Kosovo, as amended and supplemented by Law No. 05/L –150, and Article 125, paragraph 8, subparagraph 8.4, of the Law on Payment Services. Article 6 Repeal Upon entry into force of this Regulation, the Regulation on regulatory capital and safeguarding the funds of non-bank financial institutions’ customers provisions regarding safeguarding of funds adopted by the Board of the Central Bank of the Republic of Kosovo on 29 November 2019, shall be repealed. Article 7 Entry into force This Regulation shall enter into force 15 days from the date of its approval. Dr.sc. Bashkim Nurboja Chairperson of the Board of the Central Bank of the Republic of Kosovo